The vulnerability allows authenticated users with contributor or higher access to inject arbitrary JavaScript through the leafext-cookie-time and leafext-delete-cookie shortcodes by supplying unsafe values for the unset, before, and after attributes. The injected code is stored and executed whenever a page containing the affected shortcode is viewed, providing attackers the ability to steal cookies, hijack sessions, or perform other client‑side malicious actions.

WordPress sites running the DSGVO snippet for Leaflet Map and its Extensions plugin version 3.1 or earlier are affected. Users with contributor role or greater can exploit the flaw by creating or editing content that includes the vulnerable shortcodes.

The flaw carries a CVSS score of 6.4, indicating moderate severity. EPSS data is unavailable and the vulnerability is not listed in KEV, suggesting no confirmed public exploits. However, the attack requires authenticated access with contributor privileges and the ability to add or edit pages. Once injected, the malicious script runs in the browsers of all users who view the affected page, potentially compromising confidentiality and session integrity.